Security

taiku encrypts your terminal traffic before it leaves your machine, and the relay forwards it as ciphertext. The server runs the session and checks who is allowed in.

A shared link carries its key after the #, which browsers don't send to the server. When you're signed in, though, your devices send their session links, key included, to your account so you can open them from anywhere, so the server does hold the keys to those sessions. See Signed-in devices.

Session keyCopy Anchor Link

When you start a session, taiku generates a random session secret on your machine and embeds it in the URL fragment, the part after #:

Session URL: https://taiku.live/s/abc123#e8Xk9mBzQ2pR4w
                                        ^^^^^^^^^^^^^^
                                        session secret (not sent as part of the HTTP request)

Normal page loads do not send URL fragments to the server, so the raw secret stays on the device that opened the link. That device reads the fragment locally and derives the same encryption key your machine used to start the session.

The encryption key is derived locally on every device: the host and each person who joins. Opening a link sends the server only a derived check value it uses to confirm a device holds the right secret, not the raw secret.

What is encryptedCopy Anchor Link

The important boundary is this: terminal bytes are encrypted; collaboration and session-coordination metadata is not.

What the server seesCopy Anchor Link

The server can observe:

• that a session exists
• the session ID and participant count
• the coordination metadata listed above
• encrypted payload sizes and timing
• the derived verifier values used for session-key and write/admin checks
• whether viewer OAuth is required for the session

What the relayed traffic does not show the server:

• terminal output
• your keystrokes as a viewer
• the raw session secret in the URL fragment

Signed-in devicesCopy Anchor Link

A device signed in to your account sends the links of the sessions it runs, key included, to your account in its regular heartbeat, so the dashboard can open them from any of your devices. The server keeps those links. For those sessions it holds the key, and the protection above is against the relay and the network, not against the server. A session you move to a cloud workspace runs on taiku's machines, and its key is sent to the server too.

The trust modelCopy Anchor Link

Taiku's terminal privacy model is "server can coordinate, but should not be able to read terminal content." The main assumptions are:

• the server honestly relays encrypted terminal traffic and enforces access rules
• the host machine and participant devices are trusted endpoints
• the session URL fragment stays private to authorized participants

This helps against routine server logging of relayed terminal content and passive network observation beyond normal TLS.

It does not help against:

• compromised host or viewer devices
• leaked full URLs
• traffic analysis based on timing or volume
• the server itself, for sessions whose links your signed-in devices sent to your account
• plaintext metadata leakage for chat, presence, sizing, and similar coordination messages

Write access separationCopy Anchor Link

When you share a session with separate reader, writer, and admin access, each role gets its own standalone link with its own secret in the URL fragment.

Every role decrypts the same terminal stream; there is no second encryption key. The difference is that each link carries a different secret, so holding the reader link does not reveal the writer or admin link. The role you connect with is what determines whether the server lets you type, or administer tunnels.

Control inside shared sessionsCopy Anchor Link

Write access to a session does not mean every participant can take over every terminal. Terminals have owners, and taiku checks control actions against that ownership boundary.

In normal collaboration:

• You can type into, resize, and close terminals you created.
• You can see and peek at other participants' terminals, but you cannot control their active terminals without an explicit handoff.
• Tunnel admins can control other users' terminals when administering the session.

Terminal labels and diagnostic IDs are not treated as permission by themselves. Commands that originate from inside a taiku shell are tied to that specific shell before they can affect session state. Agent status is also attached to the terminal where the agent is actually running, so one terminal cannot claim agent activity for another terminal.

Guests on your machineCopy Anchor Link

When people join a sandboxed session with their own taiku accounts, their shells run on your machine but keep their own things apart from each other. Each signed-in guest gets a private folder for their coding-agent logins, shell history and, in the default isolated mode, their home directory. Another guest's shell cannot read it. If you started taiku with --sandbox-ro, every sandboxed guest shell gets the workspace read-only, and guests can't upload, save, rename or unzip files through the app either, or approve read-write access to a path. Every sandboxed shell the app opens for a guest on macOS or Linux runs in isolated mode, and none of your agent logins reach it, whatever --agent-credentials says. Guest shells that run without the sandbox, and every guest shell on Windows, run as you and can read your files. In those, and in a trusted sandboxed shell (which the app does not offer; there it covers Claude's file-based login, Codex, OpenCode, Amp and Cursor, not Gemini or a login kept in the macOS Keychain), --agent-credentials host starts everyone's agents on your logins, and own-or-host does that for guests who have not signed in (see What a sandboxed shell gets). Guests are told where their folder is and can delete it with taiku-forget. See Guests use their own agent logins for how long the folder is kept and how to have it removed when the session ends.

The folder is on your machine, so you, as the host, can read it. Invite people you would trust with that.